Described is a system and method for analyzing, by a plurality of detection algorithms, a data stream, including a plurality of packets, each packet including a source address and a destination address, detecting, by at least one of the detection algorithms, at least one of a specific behavior corresponding to an unwanted activity and generating a record including the source address and the destination address of the data packet in which the specific behavior was identified.